Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/niki914/zafironpx agentmods add skills/niki914/zafiro/zafiro-qaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/niki914/zafiro/zafiro-qa)<a href="https://agentmods.dev/skills/niki914/zafiro/zafiro-qa"><img src="https://agentmods.dev/badge/skills/niki914/zafiro/zafiro-qa/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/niki914/zafiro/zafiro-qa"><img src="https://agentmods.dev/badge/skills/niki914/zafiro/zafiro-qa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00071 | $0.01783 |
| Opus 5.5 | $0.00028 | $0.00713 |
| Sonnet 5.5 | $0.00014 | $0.00357 |
| Haiku 4.5 | $0.00007 | $0.00178 |
Grade A, and why
zafiro-qa scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
在 PC 侧通过 `curl` 检查端点健康度: How it starts
The opening of the file, as written. The whole thing — 123 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Zafiro QA
通过真机已部署的 Release 版 Zafiro(提供 MCP 服务),驱动手机自动化测试与状态验证,对开发中的 Debug 版 Zafiro 进行功能 QA。
核心架构与操作红线
本项目在真机上采用 双包共存(Dual-App)架构:
| 版本 | 包名 | 职责 | 关键要求 |
|---|---|---|---|
| Release 版 | com.niki914.zafiro |
测试基础设施:在后台提供 Zafiro MCP 服务(端口 8791),作为 Agent 操控手机的手和眼。 | 【绝对红线】严禁 kill、uninstall 或清空 Release 版数据,任何导致 Release 版退出的操作都会直接打断 MCP 连接! |
| Debug 版 | com.niki914.zafiro.debug |
被测目标(SUT):包含当前分支最新代码、新开发工具或待测修复,有独立的沙箱数据与日志目录。 | 所有环境注入(配置/设置)、UI 操控演练、日志拉取与断言,均只针对 Debug 版。 |
心智模型:“坐在 Release 版(MCP 遥控器)上,伸手去测 Debug 版(被测目标)”。
本文档所涉及的任何操作手机的行为:安装、触控和截屏等,必须有用户的授权才可执行!
阶段一:MCP 服务感知与就绪准备
在开始执行测试动作前,必须确认 Harness(宿主环境)是否已感知到 zafiro MCP 服务。
1. 感知判断
[NOTE] 这一步无须读取任何配置,问问自己,自己是否有这些工具,如果没有,则是没感知到,无须通过任何配置文件判断这一点
检查当前环境中是否存在 zafiro 相关的 MCP 工具(如 zafiro_screenshot、zafiro_launch_app、zafiro_load_skill、screenshot 等):
- 若能直接感知到:说明连接正常,直接跳到 阶段二 开始测试。
- 若无法感知到:按以下步骤建立端口转发并等待注入。
2. 建立 ADB 端口转发
Release 版 Zafiro 内置的 MCP HTTP 服务默认监听在 Android 设备的 8791 端口。
在 PC 终端执行端口转发:
adb forward tcp:8791 tcp:8791
3. 验证端点连通性
在 PC 侧通过 curl 检查端点健康度:
curl -I -s http://127.0.0.1:8791/mcp
- 若返回 HTTP 响应(通常为
400或405等非连接拒绝状态),证明链路已通; - 若出现
Connection refused,应停止操作并建议用户检查手机上 Release 版 Zafiro 是否在前台或后台存活。
4. 停下等待注入(重要)
当 curl 验证通过但当前 Agent 仍未感知到 MCP 工具时:
必须停下并提示用户:“已完成 adb forward (端口 8791),端点连通正常。请确认在当前 Harness 中注入/重载 zafiro MCP 服务后继续。”
阶段二:双轨协同测试手段
MCP 就绪后,结合 “MCP 远程驱动” 与 “ADB 沙箱底座” 两种手段进行全方位 QA。
轨道 A:通过 MCP 驱动与验证功能
-
加载手机控制能力: 在需要进行界面交互(点击、滑动、输入、截屏)前,必须优先调用 Zafiro MCP 上的
load_skill:{ "name": "phone-use" }加载完成后,即可解锁无障碍层与 Shell 层的点击、长按、滑动、输入以及真机截图能力。
-
UI 场景自动化操控:
- 启动被测 Debug 应用:
launch_app(packageName="com.niki914.zafiro.debug"); - 观察当前界面:调用
screenshot获取屏幕画面(必要时结合view_image查看); - 模拟用户交互:通过无障碍节点或坐标操作按钮、输入文本、切换对话。
- 启动被测 Debug 应用:
-
Tool 表现端到端验证: 正在开发/修复某个 Tool(如 Python 脚本工具、内置工具)时,无需在手机上人工手动点测,直接通过 MCP 调用该工具,检验其输入输出、异常处理和落盘状态是否符合预期。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 123 lines · 71 tokens per session scan A 879eb4110f4f
zafiro-qa is a skill published in the GitHub repository niki914/zafiro (274 stars, last pushed today), licensed MIT. It adds 71 tokens to every session and 1,783 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-20.
Other skills, from other repositories
mobile-automation
Control Android and iOS devices, emulators and simulators — launch apps, tap, swipe, type, take screenshots, read the accessibility tree. Use when a task involves a mobile device or app, mobile UI testing, or reproducing a bug on a phone.
feature-builder
End-to-end mobile feature builder. Takes a feature from description to fully running code with E2E tests through six phases - planning, architecture review, implementation, testing, build-fix, quality gate, and verification. Supports Android, iOS, and KMP with platform auto-detection.
android-ui-journey-testing
XML-specified Android UI journey testing, interactive step execution, assertion verification, and JSON outcome reporting.
reproduce-bug
Reproduce a reported bug in googleapis/mcp-toolbox and decide whether it is real, delivering an evidence-backed verdict: confirmed, already fixed, misconfiguration, client-side, works as intended, not reproducible, or blocked. Use whenever a maintainer asks you to reproduce, verify, confirm, or investigate a bug…
solopi-ai
A command-line framework for testing Android apps and devices with SoloPi, including on-device or cloud AI decision models. It manages devices, test cases, recorded interactions, replays, performance history, and evidence.
langbot-testing
Test LangBot WebUI and core product flows with an automated browser and backend logs. Use when validating the configured LangBot frontend, pipeline Debug Chat, model provider setup and test buttons, bot and knowledge-base UI flows, or troubleshooting failed LangBot end-to-end tests.